(t *testing.T)
| 385 | } |
| 386 | |
| 387 | func TestCrushEngineFirewallIntegration(t *testing.T) { |
| 388 | engine := NewCrushEngine() |
| 389 | |
| 390 | t.Run("firewall enabled", func(t *testing.T) { |
| 391 | workflowData := &WorkflowData{ |
| 392 | Name: "test-workflow", |
| 393 | NetworkPermissions: &NetworkPermissions{ |
| 394 | Allowed: []string{"defaults"}, |
| 395 | Firewall: &FirewallConfig{ |
| 396 | Enabled: true, |
| 397 | }, |
| 398 | }, |
| 399 | } |
| 400 | |
| 401 | steps := engine.GetExecutionSteps(workflowData, "/tmp/test.log") |
| 402 | require.Len(t, steps, 2, "Should generate config step and execution step") |
| 403 | |
| 404 | stepContent := strings.Join(steps[1], "\n") |
| 405 | |
| 406 | // Should use AWF command |
| 407 | assert.Contains(t, stepContent, "awf", "Should use AWF when firewall is enabled") |
| 408 | // With config file support, domains are in the JSON config (not as CLI flags) |
| 409 | assert.Contains(t, stepContent, "allowDomains", "Should include allowDomains in config JSON") |
| 410 | assert.Contains(t, stepContent, `\"enabled\":true`, "Should include apiProxy enabled in config JSON") |
| 411 | assert.Contains(t, stepContent, "GITHUB_COPILOT_BASE_URL: http://host.docker.internal:10002", "Should route copilot/* fallback through Copilot LLM gateway URL") |
| 412 | }) |
| 413 | |
| 414 | t.Run("firewall enabled adds mounted MCP CLI path setup", func(t *testing.T) { |
| 415 | workflowData := &WorkflowData{ |
| 416 | Name: "test-workflow", |
| 417 | ParsedTools: &ToolsConfig{ |
| 418 | CLIProxy: true, |
| 419 | }, |
| 420 | Tools: map[string]any{ |
| 421 | "bash": []any{"echo"}, |
| 422 | "my-mcp-cli": map[string]any{ |
| 423 | "command": "node", |
| 424 | "args": []any{"index.js"}, |
| 425 | }, |
| 426 | }, |
| 427 | NetworkPermissions: &NetworkPermissions{ |
| 428 | Allowed: []string{"defaults"}, |
| 429 | Firewall: &FirewallConfig{ |
| 430 | Enabled: true, |
| 431 | }, |
| 432 | }, |
| 433 | } |
| 434 | |
| 435 | steps := engine.GetExecutionSteps(workflowData, "/tmp/test.log") |
| 436 | require.Len(t, steps, 2, "Should generate config step and execution step") |
| 437 | |
| 438 | stepContent := strings.Join(steps[1], "\n") |
| 439 | assert.Contains(t, stepContent, "export PATH=\"${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH\"", "Should add mounted MCP CLI bin directory to PATH in AWF mode") |
| 440 | }) |
| 441 | |
| 442 | t.Run("firewall disabled", func(t *testing.T) { |
| 443 | workflowData := &WorkflowData{ |
| 444 | Name: "test-workflow", |
nothing calls this directly
no test coverage detected